A website that suddenly becomes slow, stops responding or displays repeated connection errors can be experiencing a distributed denial-of-service (DDoS) attack. For businesses that depend on their websites to generate leads, process orders, serve customers or provide online services, even a short period of downtime can mean lost revenue and damaged customer confidence.
A DDoS attack occurs when an attacker directs large volumes of traffic or requests at a website, server or network to overwhelm its available resources. The traffic often comes from many devices or compromised systems, making it harder to distinguish malicious activity from genuine visitors.
The good news is that a DDoS attack does not automatically mean your website has been hacked. However, responding incorrectly can prolong the disruption, and simply restarting your server may not solve the underlying problem.
This guide explains what to do when your website is under a DDoS attack, how to reduce the impact, and how to prepare your business for future incidents.
1. Confirm Whether You Are Experiencing a DDoS Attack
The first step is to establish what is actually happening. A sudden increase in traffic and a website outage can have several causes, including a legitimate marketing campaign, a hosting issue, a software problem or a DDoS attack.
Common warning signs include unusually high traffic levels, repeated requests from many different IP addresses, sudden increases in server CPU or memory usage, slow page responses, HTTP 502 or 503 errors, and a website that becomes unavailable despite the server appearing to be online.
Review your hosting control panel, server resource graphs, web server logs and available security event records. Look for unusual request patterns, unexpected traffic spikes and repeated requests to the same resource.
If your website uses Cloudflare, inspect its traffic analytics and security events for suspicious activity. These records can help you understand whether requests are being challenged, blocked or passed through to your origin server.
Do not assume every traffic spike is malicious. Blocking genuine customers because of an incorrect diagnosis can create a second business problem while you are trying to resolve the first.
2. Contact Your Hosting Provider Immediately
If the website is becoming unavailable, contact your hosting provider and explain the symptoms, when the incident started and which services are affected.
Your provider may be able to determine whether the server is under excessive load, whether the network is congested or whether the problem originates from the web application itself. They may also have network-level filtering capabilities that are not available from your website control panel.
Ask whether the attack is affecting the website alone or the wider server, whether your origin IP address is exposed, and whether additional filtering or temporary mitigation can be applied.
If you are on shared hosting, you may not have direct control over network-level protection. Your provider’s incident response is therefore particularly important. On a VPS or dedicated server, you may have more configuration options, but you should still coordinate with the provider if the attack is saturating the network connection.
Avoid repeatedly restarting services without understanding the cause. A restart may temporarily restore functionality, but it will not necessarily stop the incoming traffic.
3. Put Traffic Protection in Front of Your Website
One of the most effective ways to reduce the impact of many website-level DDoS attacks is to place a suitable reverse proxy and traffic-filtering service in front of the origin server.
Cloudflare provides a global network that can proxy supported website traffic, absorb many types of malicious requests and apply security controls before requests reach your server. The exact protection available depends on the service, configuration, attack type and where the traffic is being filtered.
If your domain is already using Cloudflare, review whether the relevant DNS records are proxied and whether your security configuration is appropriate for the affected application. If your website is not already protected, contact your hosting provider or a security specialist about the safest way to introduce mitigation.
Changing DNS records during an active incident requires care. Incorrect changes can create additional downtime, and DNS changes do not instantly solve every attack. You should also consider whether email and other services depend on the same DNS configuration before making changes.
For businesses that want this protection configured and maintained, Tremhost’s Cloudflare security services combine Cloudflare technology with assistance from Tremhost’s team.
4. Identify Whether the Attack Targets Your Network or Application
Not all DDoS attacks work in the same way. Understanding the type of attack helps determine which controls are likely to be effective.
Volumetric attacks attempt to consume available bandwidth with large amounts of traffic. Protocol-based attacks target network or connection-handling resources. Application-layer attacks send large numbers of requests to web pages, search functions, login endpoints or APIs, attempting to exhaust application or database resources.
A website may also experience a combination of these techniques.
A web application firewall can help identify and filter certain suspicious HTTP requests. Rate limiting can restrict excessive requests to selected endpoints, while caching can reduce the amount of work required from the origin server for eligible content.
However, these controls are not interchangeable. A web application firewall does not independently solve every network-level attack, and caching does not protect every dynamic request. Effective mitigation depends on matching the control to the traffic reaching the service.
If your website remains unavailable even after enabling proxy protection, involve your hosting provider. The attack may be affecting infrastructure outside the scope of your current configuration, or your origin server may still be receiving traffic directly.
5. Protect Your Origin Server
A common configuration weakness occurs when a website uses a reverse proxy but its origin server remains directly accessible to the public.
If an attacker knows the origin IP address and can connect to it directly, they may be able to bypass some of the protections intended to filter traffic before it reaches the server.
Your technical team should check whether the origin IP address is exposed, whether public DNS records reveal it, and whether the server accepts web traffic from any source. Where appropriate, restrict origin access to trusted proxy networks and maintain other necessary access paths for administration and monitoring.
Do not change firewall rules blindly during an attack. Incorrect rules can block legitimate visitors, administrative access, health checks or services that your business depends on.
Origin protection should be planned as part of the wider security configuration rather than treated as an emergency switch. If the origin address has previously been exposed, simply enabling a proxy may not be enough to prevent direct-origin traffic.
6. Reduce the Load on Your Application
Even when traffic filtering is active, your application may need additional support. Some attacks target expensive database queries, search pages, login forms or dynamic endpoints that require substantial server resources.
Your technical team can review server logs, application performance and database activity to identify which resources are under the greatest pressure. Depending on the findings, they may temporarily restrict abusive endpoints, tune caching, optimise expensive queries or apply carefully configured rate limits.
If a particular function is causing the server to struggle, temporarily limiting that function may help preserve access to other parts of the website. This should be done selectively because broad restrictions can affect legitimate customers.
Scaling server resources may help with some capacity problems, but adding CPU, RAM or bandwidth alone is not a reliable DDoS mitigation strategy. An attacker may simply generate more traffic, while the additional resources increase your costs without resolving the underlying issue.
The priority is to filter malicious requests as early as possible and ensure that the application can handle the legitimate traffic that remains.
7. Keep Customers Informed
During a prolonged outage, customers may not know whether the business has closed, whether their orders were received or whether their personal information is at risk.
If your website is a critical customer channel, use an independent communication channel such as your official social media account, a status page hosted separately from the affected infrastructure or an established customer communication platform.
Explain which services are affected and provide updates when you have confirmed information. Avoid publishing technical details that could help an attacker, and do not claim that customer information has been compromised unless there is evidence to support that conclusion.
A DDoS attack is primarily an availability attack, but it does not prove that no other security incident has occurred. If you discover suspicious administrative access, unauthorised changes or other indicators of compromise, investigate those separately.
8. Check for Recovery Before Declaring the Incident Over
Once traffic has been filtered and the website starts responding again, confirm that the recovery is genuine.
Test the website from more than one connection, verify that important pages load correctly, and confirm that essential functions such as login, checkout, booking forms and customer portals work as expected.
Monitor traffic volumes, server resource usage and security events for renewed suspicious activity. Review whether the origin server is still exposed and whether the protections introduced during the incident are working as intended.
Keep a record of when the disruption began, which services were affected, which mitigations were applied and when normal operations resumed. This information can help your team improve its response and provide a useful incident report for management.
Do not remove emergency restrictions simply because the homepage is loading. Make changes deliberately and verify their impact.
9. Prevent the Next DDoS Incident From Becoming a Crisis
You cannot guarantee that a website will never be targeted. You can, however, reduce the likelihood that an attack will cause prolonged downtime.
A resilient website needs appropriate DDoS mitigation, a properly configured reverse proxy where suitable, protected origin infrastructure, sensible application controls, regular monitoring and a clear incident response process.
Your business should also know who to contact when the website goes down, who has authority to make emergency configuration changes and how customers will receive updates. These decisions are easier to make before an attack than during one.
Review your hosting architecture periodically, particularly if your website has grown in traffic, added customer-facing functionality or become more important to daily operations.
For organisations that depend on online sales, customer portals or business applications, website security should be considered an operational requirement rather than an optional technical extra.
How Tremhost Can Help Protect Your Website
Tremhost provides Cloudflare-based website security services for businesses that want help configuring and maintaining protection rather than navigating every security setting themselves.
Through Tremhost Armor Guard, businesses can access a Cloudflare Pro-based website protection service offered at Tremhost’s advertised price of $9 per month per website. The service is designed to help businesses deploy and configure relevant protection, including traffic filtering, firewall controls and CDN functionality.
For organisations that need more extensive assistance, Tremhost Armor Shield offers a higher-tier managed security service. Review the current plan scope and terms to determine which service best fits your website and incident-response requirements.
The right solution depends on your application’s architecture, the type of traffic being targeted and the protection your business requires. No single service can guarantee immunity from every attack, and a website that is already experiencing a serious network-level incident may also need intervention from its hosting or network provider.
You can explore the available options on the Tremhost Cloudflare services page.
Final Thoughts
When a website is under a DDoS attack, the priority is to restore availability without making the situation worse. Confirm the symptoms, contact your hosting provider, apply appropriate traffic filtering, protect the origin server and monitor the website carefully during recovery.
Once the immediate incident is under control, use what you learned to strengthen your infrastructure and prepare a clear response plan.
Your website is part of your business operations. Having the right protection and knowing who will respond when something goes wrong can make the difference between a short disruption and a costly outage.
